Subject: [sacm] Alexey Melnikov's No Objection on draft-ietf-sacm-nea-swima-patnc-03: (with COMMENT)

From: Alexey Melnikov <[email-masked]>
Date: Wed, 28 Feb 2018 07:13:53 -0800

Alexey Melnikov has entered the following ballot position for
draft-ietf-sacm-nea-swima-patnc-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sacm-nea-swima-patnc/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for addressing my DISCUSS and many of my comments. Remaining comments
listed below (plus see updated point #7)

Minor:

(Points not mentioned below were addressed).

2) When referencing RFC 5198 (Network Unicode format), I personally prefer a
stricter version that disallows control characters (other than CR LF). In RFC
5198, use of control characters is only "SHOULD NOT". So you might want to make
a stronger statement on this.

5) In Section 4.3.  Required Exchanges

   All SWIMA-PVs and SWIMA-PCs MUST support both types of exchanges.

I question the value in requiring SWIMA-PVs in supporting both types of
exchanges. For example, if a SWIMA-PV never uses subscriptions, it doesn't seem
to need to handle subscription responses.

Similar text in 5.2:

   All SWIMA-PVs MUST be capable of sending SWIMA Request attributes and
   be capable of receiving and processing all SWIMA Response attributes
   as well as PA-TNC Error attributes.

6) Use of fields which can contain both human readable and possibly machine
readable information - I think this is rather handwavy and I wish you would be
more specific. Also consider issues raised in BCP 18 (RFC 2277), in particular
language tagging of human readable text.

7) (downgraded from DISCUSS): SWID registry is using
"http://invalid.unavailable" Tag Creator RegID value in Section 6.1.1.

invalid.unavailable is not a valid domain name and "unavailable" is not
registered in the special-use domain registry
<https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml>

I am not entirely sure how big of a problem this is, but use of something which
can be interpreted as a URI in a non existing non special-use domain seems like
a bad idea. Note, if you can change the value to "http://unavailable.invalid",
that would address my concern.